[SHIRO-380] runAs feature (still) doesn't work

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.2.1
• Fix Version/s: 1.2.2
• Component/s: Realms
• Labels: principal, shiro, subject
• Assignee: Unassigned
• Reporter: Jochen Munz
• Created: 07/Aug/12 14:41
• Updated: 15/Jul/16 14:48
• Resolved: 15/Jul/16 14:48

Description

Right after SecurityUtils.getSubject().runAs(new new SimplePrincipalCollection()

{...}

)

SecurityUtils.getSubject().getPrincipal() returns correct new Principal
SecurityUtils.getSubject()..getPreviousPrincipals() returns correct original Principal

but DefaultSubjectDAO merge principals in method

protected void mergePrincipals(Subject subject) {
PrincipalCollection currentPrincipals = subject.getPrincipals();
...
if (session == null)

{ ... }

else {
PrincipalCollection existingPrincipals = (PrincipalCollection) session.getAttribute(DefaultSubjectContext.PRINCIPALS_SESSION_KEY);
if (CollectionUtils.isEmpty(currentPrincipals))

{ ... }

else {
if (!currentPrincipals.equals(existingPrincipals))

{ session.setAttribute(DefaultSubjectContext.PRINCIPALS_SESSION_KEY, currentPrincipals); }

}
}

and after that
SecurityUtils.getSubject().getPrincipal() and SecurityUtils.getSubject().getPreviousPrincipals() both returns new Principal - this is wrong behavior

Issue Links

• is a clone of: SHIRO-344 runAs feature doesn't work